Data minimisation

What it means

Data minimisation is one of the core principles of the GDPR. Personal data must be adequate, relevant and limited to what is necessary for the purpose of processing. A company may not collect data “just in case” or “in case it comes in handy”, only what it really needs for a specific purpose.

The principle has three dimensions: which data is collected, for instance whether a form really needs a date of birth; who has access, meaning only people who need it for their work; and how long it is kept. Linked to it is the storage limitation principle, under which data is deleted or anonymised once the purpose ends.

Minimisation is also practical protection. What a company does not hold cannot leak and does not need protecting, updating or releasing in response to data subject requests. Less data means less risk, lower costs and easier compliance with other obligations.

How it works in practice

In a review we recommend going through every form, template and system and asking for each field why the company needs it. Copies of ID cards, national ID numbers or dates of birth are often collected out of habit although the purpose does not require them. The outcome goes into the record of processing activities.

For retention periods, statutory obligations must be distinguished. Payroll records, accounting documents and documents needed for tax purposes must be kept by law, even against the wishes of an employee or client. Other data, such as CVs of unsuccessful applicants, should be deleted after a reasonable time.

For testing, analysis or sharing with suppliers, pseudonymisation or anonymisation helps. Developers do not need real client names, and an analyst does not need national ID numbers to see sales trends.

What to watch out for

The most common mistake is collecting copies of identity documents without a legal reason. A bank or an entity subject to AML needs one; an ordinary shop or hotel generally does not. The Office for Personal Data Protection has repeatedly penalised such copying.

The second mistake is unlimited retention. Old customer databases, emails or backups from years long past are a risk in a breach and when someone asks for erasure. Regular deletion according to set periods is easier than working out afterwards everything the company holds about a person.